CVE-2025-5287

Description: It is an exploit code that works for multiple urls and multi thread for Unauth Sql Injection on Wp plugin with CVE-2025-5287 Example usage: usage: CVE-2025-5287.py -h --file FILE --fudge FUDGE --timeout TIMEOUT --threads THREADS --proxy PROXY Time-Based SQLi Checker Clean, Threaded,...

nakivo-arbitrary-file-read-poc-CVE-2024-48248

CVE-2024-48248 NAKIVO Backup and Replication Solution: Unauthenticated Arbitrary File Read Proof of Concept See our blog post for technical details Detection in Action root@kitploit: python3 watchtowr-vs-nakivo-arbitrary-file-read-poc-CVE-2024-48248.py --url https://192.168.1.1:4443 --file...

CVE-2026-92298

EspoCRM through 10.0.8 uses PHP's rand function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of a cryptographically secure generator. Remote unauthenticated attackers can guess these roughly 31-bit tokens to confirm opt-ins, accept or decline event...

CVE-2023-1389

TP-Link Archer AX21 - Unauthenticated Command Injection Loader POC CVE-2023-1389 Exploit Title: TP-Link Archer AX21 - Unauthenticated Command Injection Date Found : 07/25/2023 Exploit Author: Voyag3r root@kitploit: How to Use :- Scanning - Use Zmap : zmap -p 80 -o list.txt NetCat Listener - apt...

watchTowr-vs-FortiWeb-CVE-2025-25257

watchTowr-vs-FortiWeb-CVE-2025-25257 Detection Artifact Generator for FortiWeb CVE-2025-25257 See our blog post for technical details https://github.com/user-attachments/assets/e59f2b3b-2b9b-469f-b4a8-2b7df2ede194 Detection in Action root@kitploit: python watchTowr-vs-FortiWeb-CVE-2025-25257.py...

CVE-2024-40711

CVE-2024-40711 Exploit for Veeam backup and Replication Pre-Auth Deserialization CVE-2024-40711 See our blog post for technical details https://github.com/user-attachments/assets/24e8122c-3e84-408b-87a9-684a9aabeb70 PoC in Action root@kitploit: CVE-2024-40711.exe -f binaryformatter -g Veeam -c...

CVE-2026-92298

EspoCRM through 10.0.8 uses PHP's rand() function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of a cryptographically secure generator. The tokens are roughly 31-bit , allowing remote unauthenticated attackers to guess them and confirm opt-ins, accept or...

CVE-2026-92298 EspoCRM through 10.0.8 Weak Token Generation via rand()

EspoCRM through 10.0.8 uses PHP's rand function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of a cryptographically secure generator. Remote unauthenticated attackers can guess these roughly 31-bit tokens to confirm opt-ins, accept or decline event...

EUVD-2026-80078

EspoCRM through 10.0.8 uses PHP's rand function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of a cryptographically secure generator. Remote unauthenticated attackers can guess these roughly 31-bit tokens to confirm opt-ins, accept or decline event...

CVE-2023-23752-poc

Affected versions: 4.0.0 = 4.2.8 Joomla 3 and below are not affected by this vulnerability. http://127.0.0.1/Joomla/api/index.php/v1/config/application?public=true This API is used to obtain the most important configuration information of the website, including the database username and password...

CyberhawksLab-telnetCVE

CyberHawks lab demo finding report Credit to: @SafeBreach-Labs CVE: CVE-2026-24061 Lab: Cyberhawks Lab Target: 10.1.1.1 demo.cyberhawks.lab Finding ID: WU-08 Date: 2026-09-08 Severity: Critical Status: Confirmed / Exploited Executive Summary During an assessment of the Cyberhawks lab environment,...

CVE-2022-47966-Scan

CVE-2022-47966 Scanner About CVE-2022-47966 is a critical unauthenticated remote code execution vulnerability affecting at least 24 on-premise ManageEngine products. The vulnerability applies only if SAML SSO is enabled. For some products it also applies if SAML SSO was previously enabled. Timeli...

CVE-2023-22515-Exploit-Script

Automated Exploitation of CVE-2023-22515 - Confluence Privilege Escalation This repository contains an automated exploit script for CVE-2023-22515, a critical vulnerability in Atlassian Confluence that allows unauthorized attackers to create administrative accounts and gain full control of...

CVE-2019-19550

CVE-2019-19550 Description Remote Authentication Bypass in Senior Rubiweb 6.2.34.28 and 6.2.34.37 allows admin access to sensitive information of affected users using vulnerable versions. The attacker only needs to provide the correct URL. Important Dates Announcement to Vendor: 2019-12-02 Public...

cve-2023-46747

CVE-2023-46747 Exploit Script This script exploits the F5 BIG-IP TMUI remote code execution vulnerability CVE-2023-46747. It allows an unauthenticated attacker to execute arbitrary commands on a vulnerable F5 BIG-IP system. Table of Contents Features Requirements Usage Parameters How It Works...

CVE-2026-82222

⚡ GHOSTLYR00T - GiveWP RCE Exploit Framework CVE-2026-82222 - GiveWP Unauthenticated RCE Exploit Mass Scanner + Auto-Detection + Multi-Threading + Interactive Shell 📋 Daftar Isi | Table of Contents Overview Fitur Utama | Key Features Vulnerability Details Instalasi | Installation...

CVE-2024-23692

Rejetto HTTP File Server HFS Unauthorized RCE Vulnerability Reproduction CVE-2024-23692 Introduction Rejetto HTTP File Server HFS is a lightweight HTTP file server widely used for file sharing and file transfer. CVE-2024-23692 is a template injection vulnerability that allows a remote,...

CVE-2020-24029

CVE-2020-24029 Description Because of unauthenticated password changes in ForLogic Qualiex v1 and v3, customer and admin permissions and data can be accessed via a simple request. Important Dates Announcement to Vendor: 2020-07-12 Public disclosure date: 2020-08-31 Vulnerability Type Incorrect...

CVE-2020-24030

CVE-2020-24030 Description ForLogic Qualiex v1 and v3 has weak token expiration. This allows remote unauthenticated privilege escalation and to access sensitive data via token reuse. Important Dates Announcement to Vendor: 2020-07-12 Public disclosure date: 2020-08-31 Vulnerability Type Incorrect...

gibbonlms-filewrite_rce

Gibbon LMS Arbitrary File Write / RCE Vulnerability Information Arbitrary File Write in Gibbon LMS for RCE CVE-2023-45878 GibbonEdu Gibbon LMS version 25.0.1 and earlier allows Arbitrary File Write because rubricsvisualisesaveAjax.php does not require authentication. The endpoint accepts the img,...